A poisoned README. A malicious MCP server. Both attacks originate outside the endpoint's field of view, and both look like routine activity by the time anything lands. Here's what an agent-aware control plane actually does.